Settings protect you from the vendor. Habits protect you from yourself. Here’s both.
The REALTOR® Code of Ethics and the regulation in every state require that an agent keep client information confidential. That rule didn’t change when you started pasting contracts into a chatbot. The risk surface did.
I’ve spent the last couple of years teaching agents and brokers how to use Claude and ChatGPT well. The question I get more than any other isn’t about prompts. It’s some version of “Is my client’s stuff safe in there?” The answer is: it can be, if you set it up on purpose. Most people don’t.
This post walks through the settings, toggles, and habits that keep your AI accounts private, keep your uploads out of model training, and keep a careless share button from putting a client’s financials on Google. If you want the printable version with the audit checklist, the full field guide is at the bottom.
TLDR: use a paid plan, turn training off, audit your shares, and keep the truly sensitive stuff in a session that forgets.
Three things almost everyone gets wrong
Private and not-used-for-training are two different switches. Turning off model training does not revoke a shared link. Deleting a shared link does not turn off training. You need both, and they live in different places.
Free accounts are consumer accounts, and consumer accounts default to training. Both Anthropic and OpenAI turn training on by default for consumer tiers and ask you to opt out. OpenAI’s help center goes further: after you opt out, clicking thumbs-up or thumbs-down can still send that entire conversation to training. The free tier is built for the vendor’s benefit. That’s not a scandal. It’s just the deal.
“Private” never means zero human access. Both vendors state that a limited number of authorized staff and contractors can review content for safety, abuse, support, and legal reasons. Settings reduce exposure. They don’t create attorney-client privilege. If a document would hurt a client in the wrong hands, redact it before it goes in, or don’t put it in at all.
Why this matters more in our business than most
We handle Social Security numbers, bank statements, pay stubs, wire instructions, and divorce decrees. One stray upload is a data breach with a name attached.
A chat that includes protected-class details about a client is a Fair Housing liability if it ever leaves your account.
Scammers who get a look at your transaction chatter know exactly which closing to spoof. Wire instructions never go into a chatbot. Full stop.
And in Virginia, the supervising broker owns the compliance problem. If your agents are on free accounts, you own that too.
The paid-plan rule
If you’re using a free AI account for client work, stop. Today.
Free tiers don’t give you the controls this whole approach depends on, and the ones they do give you are opt-out, buried, and easy to undo by accident. A paid personal plan is the floor. A business or team workspace is the standard for a professional.
| Plan | Training default | Admin controls | Client work? |
|---|---|---|---|
| Claude Free | On. Must opt out. | None | No |
| Claude Pro / Max | On. Must opt out. | None | Floor. Training off, shares audited. |
| Claude Team / Enterprise | Off by commercial terms | Yes. Sharing limited to your org. | Standard for brokerages |
| ChatGPT Free | On. Must opt out. | None | No |
| ChatGPT Plus / Pro | On. Must opt out. Feedback can re-enable per chat. | None | Floor. Training off, feedback off. |
| ChatGPT Business / Enterprise | Off by default | Yes. Workspace retention and access policies. | Standard for brokerages |
Judgment call for brokers: write a policy that says client PII and transaction documents only go into an approved, paid, training-off account, and that free accounts are for drafting a birthday post and nothing else. Put it in the policy manual. Train on it. Audit it twice a year.
Lock down Claude: eight steps, five minutes
Paths are for the web and desktop app. On mobile the same items live under your name > Settings > Privacy.
- Turn off training. Settings > Privacy > Help Improve Claude > Off. New chats stop going to training immediately, and previously stored chats are pulled from future training runs. Data already baked into a finished model stays there. Nothing undoes that.
- Audit shared chats. Settings > Privacy > Shared chats > Manage. Unshare anything you don’t want live. A shared chat is a snapshot of everything up to the moment you shared it, including artifacts. Attached files aren’t included, but what Claude said about them is.
- Audit published artifacts. Open the Artifacts section in the sidebar. A published artifact is viewable by anyone with the link, no account required. This list is separate from shared chats. People miss it.
- Check Projects. Project knowledge files are visible to everyone with access to that Project. Make sure the access list is what you think it is.
- Review memory settings. Memory doesn’t affect public exposure, but it means client details from one conversation can surface in another. If you share a screen in a listing appointment, that matters.
- Review connectors. Every connected app (Drive, Gmail, your CRM) is a door. Keep the ones you use. Disconnect the ones you tried once in March.
- Use Incognito for the sensitive stuff. Incognito chats skip history, skip memory, and are never used for training, regardless of the toggle in step 1.
- Don’t rate confidential chats. Thumbs up and thumbs down are feedback submissions. Don’t submit feedback on a chat with client data in it.
On Team and Enterprise plans, training is off by contract and chats can only be shared inside your organization. If your brokerage is big enough to have an IT person, this is the tier. If it isn’t, Pro with the steps above is the floor.
Lock down ChatGPT: nine steps
OpenAI has more sharing surfaces, so this one takes longer. Paths are for the signed-in web app. If you use ChatGPT signed out, the training choice only sticks in that browser, which is one more reason signed-out use is off the table for client work.
- Turn off training. Settings > Data controls > Improve the model for everyone > Off. This covers conversations plus eligible uploaded files. It doesn’t delete anything already stored, doesn’t revoke shared links, and doesn’t undo training that already happened.
- Stop giving feedback on sensitive chats. OpenAI’s help center states that feedback submitted after opting out can still send the whole conversation to training. One click undoes step 1 for that chat.
- Audit shared links. Settings > Data controls > Shared links > Manage. Deleting a link stops future access. It does not erase a copy someone already saved.
- Lock down Projects. Make sure each is restricted to invited people, not “Anyone with a link.” Remove collaborators who don’t need to be there.
- Audit the Library. Files live separately from the chats they came from. Deleting a conversation doesn’t necessarily delete its Library files.
- Keep custom GPTs private. A published GPT with a knowledge file is a published knowledge file. Set sharing to Only me or Invite-only.
- Review shared pages and connected apps. Data sent to a third party runs under that party’s privacy policy, not OpenAI’s.
- Use Temporary Chat for confidential work. Temporary chats skip history, memory, and training. OpenAI says they may be retained up to 30 days for safety, so this is a privacy improvement, not a vanishing act.
- Review Memory. A client’s name and situation can resurface in an unrelated chat. Clear anything client-specific.
Habits that outrank settings
KITT never left the car unlocked, but Michael still had to decide what to put in the trunk. Same here. The settings are table stakes. The habits are the actual risk management.
Redact before you upload. Strip SSNs, account numbers, dates of birth, and full addresses when the task doesn’t need them. Summarizing a pre-approval letter doesn’t require the borrower’s Social. Replace names with roles: Buyer, Seller, Listing agent. The AI doesn’t care, and your client would.
Pick the session type on purpose. Normal chat for marketing, scripts, and anything you’d be fine seeing on a projector. Incognito or Temporary Chat for anything tied to a specific client, property under contract, or financial document. Nothing at all for anything under a nondisclosure, anything in litigation, or anything you’d need permission to share with a colleague.
Treat the share button like the send button. Before you share a chat or publish an artifact, scroll to the top and read it. Prefer exporting to a document and sending that. A shared chat link is a public page with a long URL. Long URLs are not security.
Don’t rate, don’t report, on client chats. Feedback buttons are submission buttons.
Brokers: write it down. Approved tools and tiers by name. What may and may not be uploaded, with examples agents will recognize. Required session type for client work. A twice-yearly audit signed by the agent. And who to call when something gets shared by mistake, with reporting as the expectation, not a punishment.
What “private” still doesn’t mean
Read this before you promise a client anything.
Not zero human access. Both companies reserve the right for authorized personnel to review content for safety, abuse, support, and legal process. Neither sells your data. Both will respond to a lawful subpoena.
Not retroactive. Opting out stops new data from going into future training. Anything already in a finished model is in that model.
Not instant deletion. Temporary and incognito sessions reduce retention. Deleted shared links don’t recall copies someone already downloaded.
Not a substitute for judgment. If a document would require a client’s written consent to share with a lender, it requires the same consent before it goes into an AI tool. Virginia’s duty of confidentiality doesn’t carve out software.
Two rules
Pay for the controls. Then use them every time.
The full field guide, with the printable audit checklist for both platforms, is here: Download AI Privacy Lockdown (PDF)
Verified against Anthropic’s and OpenAI’s published privacy documentation as of October 21, 2026. Menu names move. If a path here doesn’t match your screen, the vendor’s help center is the tiebreaker: privacy.claude.com and help.openai.com. This is educational content, not legal advice.